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WE CLAIM: 

1. A method of establishing a virtual circuit including at least one 
provider edge (PE) device for a virtual private network having a plurality of 
customer edge (CE) devices, the method comprising the steps of: 

- receiving, at a first said PE device, an indication from at least one said 
CE device identifying a virtual LAN (VLAN) which includes said CE 
device; and 

- establishing, for each VLAN identified which includes a plurality of CE 
devices in which at least one said CE device is connected to a second 
PE device, a virtual circuit between said first and second PE devices. 

2. A method as claimed in claim 1 , wherein the virtual circuit includes a 
plurality of PE devices belonging to a shared network infrastructure through 
which the virtual private network is provided. 

3. A method as claimed in claim 1, wherein the virtual private network 
supports a plurality of VLANs, and wherein each CE device is connected to a 
respective PE device by an interface arranged for exchanging data frames 
each including a VLAN identifier. 

4. A method as claimed in claim 3, wherein the indication received from 
a CE device and identifying a VLAN comprises a data frame including the 
identifier of said VLAN. 

5. A method as claimed in claim 4, wherein said virtual circuit is 
established for forwarding frames including said VLAN identifier. 

6. A method as claimed in claim 1, further comprising the steps of: 

- establishing a respective flooding virtual circuit in the shared network 
infrastructure between each pair of PE devices having at least one CE 
interface connected to a CE device of the VPN; 

- in response to reception of a first frame including a VLAN identifier at a 
first CE interface of a first PE device, propagating said first frame on each 
flooding virtual circuit established from the first PE device; and 
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- in response to reception of the first frame on a flooding virtual circuit at 
another PE device, propagating the first frame to each CE device of the 
VPN connected to said other PE device. 

7. A method as claimed in claim 6, further comprising the following 
steps in response to the reception of the first frame including said VLAN 
identifier at the first CE interface: 

- allocating, at the first PE device, a first virtual circuit resource for the 
VLAN identifier included in the first frame; 

- transmitting a first signaling message from the first PE device to each 
other PE device having at least one CE interface connected to a CE 
device of VPN, said first signaling message indicating the first virtual 
circuit resource and the VLAN identifier; and 

- in response to reception of the first signaling message at each other PE 
device, storing an identification of the first virtual circuit resource in 
association with the VPN and VLAN identifier. 

8. A method as claimed in claim 7, further comprising the following 
steps in response to reception of a second frame including said VLAN identifier 
at a second CE interface, connected to a CE device of said VPN, of the second 
PE device, whereby it is detected that the first and second CE interfaces both 
correspond to said VLAN identifier: 

- allocating, at the second PE device, a second virtual circuit resource for 
the VLAN identifier; and 

- transmitting a second signaling message from the second PE device to 
the first PE device, thereby completing the establishment of a virtual 
circuit, defined by said first and second virtual circuit resource. 

9. A method as claimed in claim 8, wherein frames pertaining to the 
VPN and including said VLAN identifier are forwarded from the first PE device 
to the second PE device by means of the second virtual circuit resource, and 
frames pertaining to said VPN and including said VLAN identifier are forwarded 
from the second PE device to the first PE device by means of the first virtual 
circuit resource. 
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10. A method as claimed in claim 8, wherein the first and second virtual 
circuit resources are labels of a multi-protocol label switching architecture. 

11. A method as claimed in claim 10, wherein the first and second 
signaling messages are in accordance with a label distribution protocol 
supported by the multi-protocol label switching architecture. 

12. A method as claimed in claim 8, further comprising the step of 
forwarding the second frame to the first PE device by means of the first virtual 
circuit resource. 

13. A method as claimed in claim 11, wherein said second frame is 
forwarded by the first PE device through the first CE interface, identified as 
corresponding to the VLAN identifier for which the first virtual circuit resource 
has been allocated. 

14. A method as claimed in claim 1, wherein the VPN has a topology 
such that at most two CE devices thereof are allowed to communicate frames 
including a given VLAN identifier. 

15. A method as claimed in claim 1, wherein each CE device is 
connected to a respective PE device through an Ethernet interface. 

16. A method as claimed in claim 1 , wherein said virtual circuit is a label- 
switched path of a multi-protocol label switching architecture of a network 
infrastructure interconnecting a plurality of PE devices. 

17. A method as claimed in claim 16, wherein the step of establishing a 
virtual circuit comprises exchanging messages of a label distribution protocol 
supported by the multi-protocol label switching architecture between said first 
and second PE devices. 

18. A method as claimed in claim 1, wherein said first and second PE 
devices are distant devices communicating through a shared network 
infrastructure. 
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19. A method as claimed in claim 1, wherein said first and second PE 
devices are collocated in a provider equipment. 

20. A method of providing a virtual private network (VPN) service 
through a shared network infrastructure comprising a plurality of interconnected 
provider edge (PE) devices having customer edge (CE) interfaces, wherein 
some of the CE interfaces are allocated to a VPN supporting a plurality of 
virtual local area networks (VLANs) and are arranged for exchanging tagged 
data frames with CE devices respectively connected to the PE devices through 
said CE interfaces, each tagged frame including a VLAN identifier, the method 
comprising the following steps: 

- receiving at least one tagged frame from a CE device at each CE 
interface allocated to said VPN, and learning a correspondence between 
said CE interface and each VLAN identifier included in said at least one 
tagged frame; 

- detecting whether a pair of CE interfaces allocated to said VPN and 
belonging to two PE devices correspond to a common VLAN identifier; 
and 

- in response to such detection, establishing at least one virtual circuit in 
the shared network infrastructure between said two PE devices, for 
forwarding frames including said common VLAN identifier. 

21. A method as claimed in claim 20, further comprising the following 
steps: 

- establishing a respective flooding virtual circuit in the shared network 
infrastructure between each pair of PE devices having at least one CE 
interface allocated to said VPN; 

- in response to reception of a first tagged frame including a VLAN 
identifier at a first CE interface, allocated to said VPN, of a first PE 
device, propagating said first tagged frame on each flooding virtual circuit 
established from the first PE device; and 

- in response to reception of the first tagged frame on a flooding virtual 
circuit at another PE device, propagating the first tagged frame to each 
CE interface, allocated to said VPN, of said other PE device. 
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22. A method as claimed in claim 21, wherein the correspondence 
between the first CE interface and the VLAN identifier is learnt in response to 
the reception of the first tagged frame including said VLAN identifier at the first 
CE interface. 

23. A method as claimed in claim 21, further comprising the following 
steps in response to the reception of the first tagged frame including said VLAN 
identifier at the first CE interface: 

- allocating, at the first PE device, a first virtual circuit resource for said 
VPN and the VLAN identifier included in the first tagged frame; 

- transmitting a first signaling message from the first PE device to each 
other PE device of the shared network infrastructure having at least one 
CE interface allocated to said VPN, said first signaling message 
indicating the first virtual circuit resource and said VPN and VLAN 
identifier; and 

- in response to reception of the first signaling message at each other PE 
device, storing an identification of the first virtual circuit resource in 
association with said VPN and VLAN identifier. 

24. A method as claimed in claim 23, further comprising the following 
steps in response to reception of a second tagged frame including said VLAN 
identifier at a second CE interface, allocated to said VPN, of another PE 
device, whereby it is detected that the first and second CE interfaces both 
correspond to said VLAN identifier: 

- allocating, at said otherPE device, a second virtual circuit resource for 
said VPN and said VLAN identifier; and 

- transmitting a second signaling message from said other PE device to the 
first PE device, thereby completing the establishment of a virtual circuit, 
defined by said first and second virtual circuit resource. 

25. A method as claimed in claim 24, wherein frames pertaining to said 
VPN and including said VLAN identifier are forwarded from the first PE device 
to said other PE device by means of the second virtual circuit resource, and 
frames pertaining to said VPN and including said VLAN identifier are forwarded 



-18- 

from said other PE device to the first PE device by means of the first virtual 
circuit resource. 

26. A method as claimed in claim 24, wherein the first and second virtual 
circuit resources are labels of a multi-protocol label switching architecture of the 
shared network infrastructure. 

27. A method as claimed in claim 26, wherein the first and second 
signaling messages are in accordance with a label distribution protocol 
supported by the multi-protocol label switching architecture. 

28. A method as claimed in claim 24, further comprising the step of 
forwarding the second tagged frame to the first PE device by means of the first 
virtual circuit resource. 

29. A method as claimed in claim 28, wherein said second tagged frame 
is forwarded by the first PE device through the first CE interface, identified as 
corresponding to the VLAN identifier for which the first virtual circuit resource 
has been allocated. 

30. A method as claimed in claim 20, wherein the VPN has a topology 
such that at most two CE interfaces allocated thereto are allowed to receive 
tagged frames including a given VLAN identifier. 

31. A method as claimed in claim 20, wherein the CE interfaces 
allocated to the VPN are Ethernet interfaces. 

32. A method as claimed in claim 20, wherein said virtual circuits are 
label-switched paths of a multi-protocol label switching architecture of the 
shared network infrastructure. 

33. A method as claimed in claim 32, wherein the step of establishing a 
virtual circuit between two PE devices comprises exchanging messages of a 
label distribution protocol supported by the multi-protocol label switching 
architecture between said two PE devices. 

34. A provider edge (PE) device, comprising: 
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- means for communicating with other PE devices; 

- at least one customer edge (CE) interface; 

- configuration means for allocating at least one CE interface to a virtual 
private network (VPN) supporting a plurality of virtual local area networks 
(VLANs); 

- means for mapping a VLAN to a CE interface allocated to the VPN, said 
VI_AN being indicated in data received at said CE interface; 

- means for identifying, in relation to the indicated VLAN, another PE 
device having a CE interface allocated to the VPN; and 

- means for establishing a virtual circuit to the identified PE device. 

35. A device as claimed in claim 34, wherein the means for 
communicating with other PE devices comprise a network interface with a 
shared network infrastructure. 

36. A device as claimed in claim 34, wherein each CE interface 
allocated to the VPN is arranged for exchanging data frames with a respective 
CE device, each frame including a VLAN identifier. 

37. A device as claimed in claim 36, wherein the mapped VLAN is 
indicated by a VLAN identifier contained in at least one frame received from a 
CE device connected to said CE interface. 

38. A device as claimed in claim 37, wherein the other PE device 
identified in relation to the indicated VLAN is a PE device having received a 
frame including the said VLAN identifier 

39. A device as claimed in claim 38, wherein the means for 
communicating with other PE devices comprise a network interface with a 
shared network infrastructure, and wherein the virtual circuit is established for 
communicating frames including the indicated VLAN identifier with the identified 
PE device. 

40. A device as claimed in claim 35, further comprising: 
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- means for establishing respective flooding virtual circuits in the shared 
network infrastructure to a plurality of other PE devices configured to 
have at least one CE interface allocated to the VPN; and 

- means responsive to reception of a data frame indicating said VLAN at 
5 said CE interface, for propagating said data frame on each of the flooding 

virtual circuits established to the other PE devices. 

41 . A device as claimed in claim 40, further comprising: 

- means responsive to reception, on a flooding virtual circuit from another 
PE device configured to have at least one CE interface allocated to the 
VPN, of a second data frame indicating a VLAN not mapped to any CE 
interface, for propagating the second data frame through any CE 
interface allocated to the VPN. 

42. A device as claimed in claim 40, wherein the mapping means are 
arranged to map said VLAN to said CE interface in response to the reception of 
the first data frame indicating said VLAN at said CE interface. 

43. A device as claimed in claim 40, further comprising: 

- means for allocating a first virtual circuit resource for the VPN and the 
indicated VLAN in response to reception of a first data frame indicating 
said VLAN at said CE interface; 

- means for transmitting to each other PE device a first signaling message 
indicating the first virtual circuit resource and said VPN and VLAN. 

44. A device as claimed in claim 43, wherein the means for identifying 
another PE device are responsive to reception from said other PE device of a 
second signaling message indicating a second virtual circuit resource and said 

25 VPN and VLAN, whereby frames indicating said VLAN and received at said CE 
interface are forwarded to the identified PE device on a virtual circuit by means 
of the second virtual circuit resource. 

45. A device as claimed in claim 44, wherein the first and second virtual 
circuit resources are labels of a multi-protocol label switching architecture. 
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46 A device as claimed in claim 45, wherein the first and second 

signaling messages are in accordance with a label distribution protocol 
supported by the multi-protocol label switching architecture. 

47. A device as claimed in claim 34, wherein the VPN has a topology 
such that at most two CE interfaces allocated thereto are allowed to receive 
data frames indicating a given VLAN. 

48. A device as claimed in claim 34, wherein each CE interface 
allocated to the VPN is an Ethernet interface. 

49. A provider edge (PE) device for a shared network infrastructure, 
comprising: 

- means for communicating with other PE devices through the shared 
network infrastructure; 

- at least one local customer edge (CE) interface; 

- configuration means for allocating at least one local CE interface to a 
virtual private network (VPN) supporting a plurality of virtual local area 
networks (VLANs), the allocated local CE interface being arranged for 
exchanging tagged data frames with a respective CE device, each 
tagged frame including a VLAN identifier; 

- means for learning a correspondence between a first local CE interface 
allocated to said VPN and a first VLAN identifier included in at least one 
tagged frame received from a CE device at said first local CE interface; 

- means for identifying another PE device having a CE interface allocated 
to said VPN and having received a tagged frame including said first 
VLAN identifier; and 

- means for establishing a virtual circuit in the shared network 
infrastructure, for communicating frames including said first VLAN 
identifier with the identified PE device. 

50. A device as claimed in claim 49, further comprising: 

- means for establishing a respective flooding virtual circuit in the shared 
network infrastructure to each other PE device configured to have at least 
one CE interface allocated to said VPN; and 
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- means responsive to reception of a first tagged frame including the first 
VLAN identifier at the first local CE interface, for propagating said first 
tagged frame on each of the flooding virtual circuits established to said 
other PE devices. 

51 . A device as claimed in claim 50, further comprising: 

- means responsive to reception, on a flooding virtual circuit from another 
PE device configured to have at least one CE interface allocated to said 
VPN, of a tagged frame including a VLAN identifier for which no CE 
interface has been learnt, for propagating said tagged frame through any 
local CE interface allocated to said VPN. 

52. A device as claimed in claim 50, wherein the learning means are 
arranged to store the correspondence between the first local CE interface and 
the first VLAN identifier in response to the reception of the first tagged frame at 
the first local CE interface. 

53. A device as claimed in claim 50, further comprising: 

- means for allocating a first virtual circuit resource for said VPN and first 
VLAN identifier in response to the reception of the first tagged frame at 
the first local CE interface; 

- means for transmitting a first signaling message to each other PE device 
of the shared network infrastructure configured to have at least one CE 
interface allocated to said VPN, said first signaling message indicating 
the first virtual circuit resource and said VPN and first VLAN identifier. 

54. A device as claimed in claim 53, wherein the means for identifying 
another PE device are responsive to reception from said other PE device of a 
second signaling message indicating a second virtual circuit resource, said 
VPN and first VLAN identifier, whereby frames including said first VLAN 
identifier and received at the first CE interface are forwarded to the identified 
PE device on a virtual circuit by means of the second virtual circuit resource. 
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55. A device as claimed in claim 54, wherein the first and second virtual 
circuit resources are labels of a multi-protocol label switching architecture of the 
shared network infrastructure. 

56. A device as claimed in claim 55, wherein the first and second 
signaling messages are in accordance with a label distribution protocol 
supported by the multi-protocol label switching architecture. 

57. A device as claimed in claim 49, wherein the VPN has a topology 
such that at most two CE interfaces allocated thereto are allowed to receive 
tagged frames including a given VLAN identifier. 

58. A device as claimed in claim 49, wherein each CE interface 
allocated to said VPN is an Ethernet interface. 



